What are the signs that a campus email account has been compromised and is being used for follow-on attacks?

Common warning signs include login activity from unfamiliar locations, message rules that hide or forward mail, sudden bursts of outbound phishing emails, and recipients reporting strange payment requests. Teams should also watch for accounts that behave like internal senders but show unusual timing, tone, or attachment patterns, because attackers often use trusted identities to widen access.

How campus email compromise usually shows up in real operations

When a campus email account is taken over, the first clues are often behavioural rather than purely technical. A normal user suddenly starts authenticating from unfamiliar geographies, devices, or impossible time windows, and mailbox activity becomes less consistent with the person’s usual routine. The account may still look legitimate on the surface while being used to open the door for phishing, payment fraud, or internal reconnaissance.

The pattern to watch is not one sign in isolation but a cluster: new sign-in locations, abrupt changes in sending volume, mail that looks “right” but lands at odd times, and conversations that drift toward requests for invoices, gift cards, wire changes, or document sharing. That combination is what makes email compromise dangerous, because trusted identities let attackers borrow credibility before the recipient realises the account is misused.

Mailbox behaviour that suggests the account is being weaponised

One of the clearest indicators is rule or forwarding abuse. Attackers frequently create inbox rules that hide security alerts, auto-delete replies, or forward messages to an external mailbox so they can monitor responses after the victim regains access. In campus environments, this can be especially damaging because a compromised account may also sit inside shared departmental workflows, student-faculty exchanges, or research coordination.

Another warning sign is outbound messaging that does not fit the account owner’s normal tone, timing, or attachment habits. A previously quiet mailbox that starts sending many messages in a short burst, especially to many recipients or to people outside the institution, should be treated as suspicious. If the messages mimic internal style but carry urgent payment or document requests, the account may already be used in a follow-on attack chain.

The real risk is not only account access, but what the attacker can do after gaining trust. A compromised campus mailbox can be used to reset passwords on other services, impersonate staff or students, harvest more credentials through replies, or pivot into finance, HR, research, or identity systems. That is why mailbox compromise often becomes a broader access problem, not just an email problem.

These incidents also tend to spread through normal collaboration patterns. If the attacker can read prior threads, they can send highly convincing replies that reference current projects, vendors, or academic processes. That makes the compromise harder to spot and increases the chance that downstream recipients will act on malicious instructions without questioning the sender.

Risk and Threat Considerations

A compromised campus email account is attractive because it gives an attacker a trusted communications channel and a platform for internal abuse. The biggest exposure is follow-on fraud or lateral compromise: once the attacker can read mail and send as the user, they can impersonate authority, intercept replies, and widen access through password resets or convincing social engineering.

Failure mechanism: The attacker relies on stolen session or credential access, mailbox rule changes, and believable sender identity to hide activity, sustain persistence, and issue fraudulent requests from inside trusted campus workflows.

Impact: The result can be data exposure, phishing sent to peers, payment diversion, account takeover of connected services, and reputational harm to the account owner and institution.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1078 — Valid Accounts	Covers attacker use of stolen campus email access to operate as a trusted user.
	T1114 — Email Collection	Fits attacker reading mailbox content to abuse trust and stage follow-on attacks.
	T1114.003 — Email Forwarding Rule	Directly maps to malicious inbox rules and forwarding used to persist access.
Recommendation — Hunt for suspicious use of valid accounts and correlate it with mailbox and identity telemetry. Monitor for mailbox access patterns that indicate collection before fraudulent outreach begins. Review and remove unauthorized forwarding or hidden mail rules during compromise response.
CIS Controls v8	CIS-5 — Account Management	Relevant because compromised campus email accounts require account review, access restriction, and recovery.
	CIS-8 — Audit Log Management	Needed to detect anomalous sign-ins, rule creation, and suspicious outbound activity.
Recommendation — Validate account ownership, revoke suspicious access, and rotate affected credentials promptly. Centralise and review authentication and mail-flow logs for compromise indicators.
NIST SP 800-53 Rev 5	AC-2 — Account Management	Applies to detecting, containing, and removing misuse of compromised email accounts.
	AU-6 — Audit Review, Analysis, and Reporting	Supports investigating suspicious logins, rules, and message activity after compromise.
	IA-2 — Identification and Authentication (Organizational Users)	Relevant to proving whether a campus user login is genuine or stolen.
Recommendation — Reconcile account status, disable abused access, and force revalidation where compromise is suspected. Analyze authentication and mail logs for anomalous access and attacker actions. Strengthen authentication and challenge unusual sign-ins before granting access.

Practitioner Guidance

What to verify: Confirm whether the account has new sign-in locations, new devices, mailbox forwarding, inbox rules, OAuth consent changes, or unexplained reset activity on linked services. If any of those appear alongside outbound messages the owner cannot explain, treat the mailbox as actively compromised rather than merely suspicious.

What to prioritise: Contain the account first, then inspect recent sent items, rules, delegates, and forwarding destinations before focusing on user education. In practice, the fastest signal of abuse is often the mailbox itself, not the victim report, because attackers frequently keep using the account after the first fraudulent message goes out.

Practitioner takeaway: The highest-value response is to separate “unusual login” from “active abuse” quickly, because a campus mailbox becomes materially more dangerous once it starts sending convincing messages to real institutional contacts.